add ProductPolicyViolation model

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

product_portfolio/migrations/0018_productpolicyviolation.py

@@ -0,0 +1,38 @@
+# Generated by Django 6.0.6 on 2026-07-07 04:49
+
+import django.db.models.deletion
+import dje.models
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('dje', '0015_alter_dataspaceconfiguration_purldb_api_key_and_more'),
+        ('policy', '0003_policyrule'),
+        ('product_portfolio', '0017_scancodeproject_import_options'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='ProductPolicyViolation',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('uuid', models.UUIDField(default=uuid.uuid4, editable=False, verbose_name='UUID')),
+                ('violation_count', models.PositiveIntegerField(default=0, help_text='Number of objects currently violating the rule.')),
+                ('detected_date', models.DateTimeField(auto_now_add=True, help_text='The date and time when this violation was first detected.')),
+                ('last_checked', models.DateTimeField(auto_now=True, help_text='The date and time of the last evaluation.')),
+                ('resolved', models.BooleanField(default=False, help_text='Indicates whether this violation has been resolved.')),
+                ('resolved_date', models.DateTimeField(blank=True, help_text='The date and time when this violation was resolved.', null=True)),
+                ('dataspace', models.ForeignKey(editable=False, help_text='A Dataspace is an independent, exclusive set of DejaCode data, which can be either nexB master reference data or installation-specific data.', on_delete=django.db.models.deletion.PROTECT, to='dje.dataspace')),
+                ('policy_rule', models.ForeignKey(help_text='The policy rule that triggered this violation.', on_delete=django.db.models.deletion.CASCADE, related_name='product_violations', to='policy.policyrule')),
+                ('product', models.ForeignKey(help_text='The product in the context of which this violation was detected.', on_delete=django.db.models.deletion.CASCADE, related_name='policy_violations', to='product_portfolio.product')),
+            ],
+            options={
+                'ordering': ['-detected_date'],
+                'unique_together': {('dataspace', 'uuid'), ('policy_rule', 'product')},
+            },
+            bases=(dje.models.DataspaceForeignKeyValidationMixin, models.Model),
+        ),
+    ]

product_portfolio/models.py

@@ -56,6 +56,7 @@
 from dje.validators import generic_uri_validator
 from dje.validators import validate_url_segment
 from dje.validators import validate_version
+from policy.models import AbstractPolicyViolation
 from vulnerabilities.fetch import fetch_for_packages
 from vulnerabilities.models import AffectedByVulnerabilityMixin
 from vulnerabilities.models import AffectedByVulnerabilityRelationship
@@ -1901,3 +1902,34 @@ def save(self, *args, **kwargs):
                     "The 'for_package' cannot be the same as 'resolved_to_package'."
                 )
         super().save(*args, **kwargs)
+
+
+class ProductPolicyViolationQuerySet(ProductSecuredQuerySet):
+    def unresolved(self):
+        return self.filter(resolved=False)
+
+
+class ProductPolicyViolation(DataspacedModel, AbstractPolicyViolation):
+    """Concrete policy violation scoped to a product."""
+
+    product = models.ForeignKey(
+        to="product_portfolio.Product",
+        on_delete=models.CASCADE,
+        related_name="policy_violations",
+        help_text=_("The product in the context of which this violation was detected."),
+    )
+    policy_rule = models.ForeignKey(
+        to="policy.PolicyRule",
+        on_delete=models.CASCADE,
+        related_name="product_violations",
+        help_text=_("The policy rule that triggered this violation."),
+    )
+
+    objects = DataspacedManager.from_queryset(ProductPolicyViolationQuerySet)()
+
+    class Meta:
+        unique_together = (("dataspace", "uuid"), ("policy_rule", "product"))
+        ordering = ["-detected_date"]
+
+    def __str__(self):
+        return f"{self.policy_rule} / {self.product}: {self.violation_count} violation(s)"